Sunday

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:31 PM UTC
• Version: 1.0.1

Overview

The skill is coherent, but it gives an agent long-lived autonomous access to decrypted passwords and OTP-capable email through an unpinned external CLI.

Install only if you are comfortable giving the agent a separate identity with autonomous access to its vault and verification inbox. Prefer low-risk dedicated accounts, avoid storing personal or business-critical credentials, prefer generated passwords over passing secrets on the command line, review the CLI publisher and update path, and know how to revoke the Sunday session and rotate stored credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:4

Finding

Unpinned Third-Party Credential Manager from an External Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 4 and 18–20
Vulnerability Type: Unverified third-party dependency and supply-chain exposure
Risk Level: High

Vulnerable Code

yaml

metadata: {"openclaw": {"emoji": "☀️", "requires": {"bins": ["sunday"]}, "install": [{"id": "brew", "kind": "brew", "formula": "ravi-technologies/tap/sunday", "bins": ["sunday"], "label": "Install Sunday CLI via Homebrew"}]}}

bash

brew install ravi-technologies/tap/sunday

Technical Analysis

The skill directs users to install the sunday executable from the external Homebrew tap ravi-technologies/tap. It does not pin an immutable package version, require a cryptographic checksum, verify a release signature, or include the CLI source code for review.

This executable is subsequently entrusted with highly sensitive operations, including handling authentication tokens, encryption keys, decrypted passwords, inbox messages, verification links, and OTP codes. Consequently, compromise of the tap, formula repository, release infrastructure, maintainer account, or a later package release could cause malicious executable code to run under the user's account.

The available project contains only SKILL.md; therefore, the CLI's claimed end-to-end encryption and network behavior cannot be independently verified from the audited artifact. This finding identifies a supply-chain trust weakness rather than proving that the current external package is malicious.

Attack Path

1. An attacker compromises the external Homebrew tap, its maintainer account, the binary distribution location, or the release pipeline.
2. The attacker publishes a modified sunday package while retaining the expected executable name.
3. A user follows the skill instructions and installs or updates the unpinned package.
4. The agent invokes the compromised executable to authenticate, access the vault, or inspect email.
5. The executable ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an immutable, reviewed release rather than accepting whichever package version the tap currently serves.
• Publish and verify cryptographic checksums and signed release attestations before installation.
• Prefer a trusted package source with transparent build provenance and reproducible builds.
• Include or link to auditable source code and document the precise source revision used to build each release.
• Restrict automatic updates and require security review before deploying a new CLI version.
• Run the CLI in a least-privilege environment with narrowly scoped filesystem and network access.
• Add dependency monitoring for ownership changes, compromised releases, and unexpected formula modifications.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:22

Finding

Persistent Unattended Access to Encryption Keys, Passwords, and OTP-Bearing Email

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–29, 123–129, and 174–192
Vulnerability Type: Inadequately protected persistent secret access
Risk Level: High

Vulnerable Code

markdown

3. Authenticate (run this BEFORE starting OpenClaw):

```bash
sunday auth login

This opens a browser for login, then prompts for your 6-digit encryption PIN. After this, credentials and encryption keys are stored in ~/.sunday/config.json — no further prompts needed. All subsequent sunday commands work autonomously.

text

```bash
# List all stored passwords (shows domain and username, NOT password)
sunday passwords list --json

# Get full entry with decrypted password
sunday passwords get <uuid> --json

bash

# 1. Look up credentials
sunday passwords list --json
# Find the entry for the target domain

# 2. Get the full credentials
sunday passwords get <uuid> --json
# Returns decrypted username and password

# 3. If 2FA is required, check inbox for the code
sleep 5
sunday inbox list --type email --unread --json

Technical Analysis

The documented setup stores credentials and encryption keys in ~/.sunday/config.json and explicitly removes the need for further prompts. Subsequent processes that can invoke the CLI may request plaintext passwords or inspect email containing verification links and OTP codes.

The instructions do not document restrictive file permissions, operating-system keychain protection, hardware-backed key storage, per-secret authorization, command-level access control, vault scoping, session expiration, or user confirmation before decryption. Persistent autonomous access weakens the protection supplied by the initial PIN because possession of the configured local environment appears sufficient for later decryption.

Structured JSON output also returns decrypted credentials directly to the invoking agent or process. Such output can ente ...[truncated 1363 chars]

Remediation

View remediation

Remediation Suggestions

• Store authentication and encryption keys in an operating-system credential manager or hardware-backed keystore rather than a regular configuration file.
• Enforce owner-only permissions on every configuration and cache file and validate those permissions before use.
• Require explicit user approval, reauthentication, or a short-lived capability before returning a decrypted secret.
• Scope credentials by task, domain, or agent instead of giving every invocation access to the entire vault.
• Use short-lived sessions with inactivity expiration and a reliable revoke/logout mechanism.
• Return sensitive fields through a protected secret channel and redact passwords, OTPs, tokens, and verification links from logs and transcripts.
• Separate inbox access from vault access so compromise of one capability does not automatically expose both authentication factors.
• Document the local threat model and fail securely if protected key storage is unavailable.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:103

Finding

Plaintext Passwords Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103–115 and 132–139
Vulnerability Type: Plaintext secret exposure through process arguments and shell records
Risk Level: Medium

Vulnerable Code

bash

# Auto-generate a secure password and store it
sunday passwords create example.com --json
# → Generates password, stores encrypted entry, returns UUID

# Store with specific credentials
sunday passwords create example.com --username "[e-mail]" --password "my-secret-pass" --json

# Store with notes
sunday passwords create example.com --username "[e-mail]" --password "pass123" --notes "Free tier account" --json

bash

# Update password
sunday passwords edit <uuid> --password "new-password" --json

# Update username
sunday passwords edit <uuid> --username "[e-mail]" --json

# Delete entry
sunday passwords delete <uuid>

Technical Analysis

The documented commands place plaintext passwords directly in command-line arguments. Depending on the operating system and execution environment, command arguments may be exposed through process-inspection interfaces, process monitoring, audit systems, shell tracing, terminal scrollback, command history, agent tool transcripts, or diagnostic logs.

Encryption performed after the CLI receives the password does not protect these earlier plaintext copies. Quoting the value prevents ordinary shell word splitting but does not make the argument confidential.

The exact exploitability of process-list access depends on local operating-system controls, and noninteractive agent shells may not always persist history. Nevertheless, the documentation establishes an unsafe secret-input pattern that can leak credentials through several common observability channels.

Attack Path

1. A user or agent follows the documented example and supplies a real password with --password.
2. The shell launches `s ...[truncated 892 chars]

Remediation

View remediation

Remediation Suggestions

• Remove examples that pass passwords as command-line arguments.
• Support reading secrets from protected standard input without echo, a secure file descriptor, or an operating-system credential prompt.
• Provide an interactive --password-stdin or equivalent mode that clearly avoids process arguments.
• Disable shell tracing while handling secrets and ensure agent tooling marks secret input and output as non-loggable.
• Redact credentials from command telemetry, error messages, audit events, and retained transcripts.
• Recommend automatic password generation inside the vault whenever possible so plaintext passwords do not traverse the shell.
• Warn users to rotate any password that may already have been exposed through history or logging.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description is extremely broad and covers storing/retrieving passwords, logging into services, checking email, receiving OTPs, and any task involving agent identity. In an agentic environment, such broad activation criteria can cause the skill to be invoked for many unrelated workflows, unnecessarily exposing credential and inbox capabilities and increasing the chance of secret handling in contexts that do not require it.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs users to perform a one-time login after which credentials and encryption keys are stored locally in ~/.sunday/config.json and all later commands run autonomously. This creates persistent authenticated access to email, OTPs, and decrypted credential retrieval from the agent environment, so compromise or unintended invocation of the agent can expose a long-lived identity and vault.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## Setup (One Time)

1. **Create a Sunday account** at [sunday.ravi.app](https://sunday.ravi.app). Set up your encryption PIN and create an Identity (this gives your agent its own email address).

2. Install the CLI:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents irreversible deletion of stored credentials without any warning, confirmation, or recovery guidance. In an autonomous agent setting, this raises the risk of accidental destructive actions that can permanently remove access to service accounts or auditably important credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.